Elastic medium stable eql

Potential Privacy Control Bypass via TCCDB Modification

Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and process.name like~ "sqlite*" and
 process.args like "/*/Application Support/com.apple.TCC/TCC.db" and
 (process.parent.name like~ ("osascript", "bash", "sh", "zsh", "Terminal", "Python*") or (process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false))

Field Validations

Loading…

Comments (0)

Loading comments...